feat(cloud-agent): add per-session sandbox isolation for designated orgs

[eshurakov]

Summary

Add per-session sandbox isolation for designated organizations. Sessions for orgs in a hardcoded allowlist (PER_SESSION_SANDBOX_ORG_IDS) receive a dedicated SandboxSmall (standard-2 instance type) container via a new ses-{hash} sandbox ID format, while all other sessions continue using the shared Sandbox container.

Key architectural changes:

• New SandboxSmall Durable Object class (re-exports Sandbox from @cloudflare/sandbox) with standard-2 instance type and separate wrangler bindings/migrations
• getSandboxNamespace(env, sandboxId) routing layer inserted at every getSandbox() call site — routes ses-* IDs to env.SandboxSmall, everything else to env.Sandbox
• sandboxId is now persisted in session metadata so resumed/cold-start sessions use the correct namespace without re-deriving
• Fallback to generateSandboxId() for sessions that predate sandboxId storage ensures full backward compatibility
• SandboxId type expanded to explicitly cover all generated formats (org-, usr-, bot-, ubt-, ses-, plus legacy __-delimited)
• Schema validation uses regex .refine() instead of heuristic .transform() with mistyped as casts

Verification

• pnpm run typecheck — passed (tsgo + wrapper tsc)
• pnpm run test — 662/662 tests passed
• New unit tests for generatePerSessionSandboxId, isPerSessionSandboxOrg, getSandboxNamespace
• New integration test verifying deleteSession routes ses- prefixed IDs to SandboxSmall namespace

Visual Changes

N/A

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (15 files)

• cloud-agent-next/src/helpers.ts
• cloud-agent-next/src/index.ts
• cloud-agent-next/src/persistence/CloudAgentSession.ts
• cloud-agent-next/src/persistence/schemas.ts
• cloud-agent-next/src/persistence/types.ts
• cloud-agent-next/src/router.test.ts
• cloud-agent-next/src/router/handlers/session-management.ts
• cloud-agent-next/src/router/handlers/session-prepare.ts
• cloud-agent-next/src/router/handlers/session-questions.ts
• cloud-agent-next/src/sandbox-id.test.ts
• cloud-agent-next/src/sandbox-id.ts
• cloud-agent-next/src/session-service.ts
• cloud-agent-next/src/types.ts
• cloud-agent-next/worker-configuration.d.ts
• cloud-agent-next/wrangler.jsonc

---

_{Reviewed by gpt-5.4-20260305 · 2,296,046 tokens}